Subject: [MMUSIC] Aligning RFC 4572 and draft-dtls-sdp regarding preferred SHA cipher?

From: Christer Holmberg <[email-masked]>
Date: Thu, 25 Feb 2016 09:51:46 +0000

Hi,

RFC 4572 (tls-sdp) contains the following text:

"Following RFC 3279 [7] as updated by RFC
              4055 [9], therefore, the defined hash functions are 'SHA-1' [11]
              [19], 'SHA-224' [11], 'SHA-256' [11], 'SHA-384' [11], 'SHA-512' [11],
              'MD5' [12], and 'MD2' [13], with 'SHA-1' preferred."

Draft-dtls-sdp contains the following text:

"Endpoints MUST support SHA-256 for generating and verifying the fingerprint
               value associated with the DTLS association. The use of SHA-256 is preferred."

I.e. for TLS SHA-1 is preferred, and for DTLS SHA-256 is preferred.

Martin suggested (I assume) that we should update RFC 4572, to make SHA-256 preferred also for TLS.

Assuming we do the update, I guess the updated 4572 text would say:

"Following RFC 3279 [7] as updated by RFC
              4055 [9], therefore, the defined hash functions are 'SHA-1' [11]
              [19], 'SHA-224' [11], 'SHA-256' [11], 'SHA-384' [11], 'SHA-512' [11],
              'MD5' [12], and 'MD2' [13], with 'SHA-256' preferred."

Q1:        Do people agree to updating the preferred cipher in 4572?

Q3:        IF(Q1) Should the update be done within draft-dtls-sdp, or should we create a separate draft/milestone for it?

Regards,

Christer

---

From: Roman Shpount <[email-masked]>
Date: Thu, 25 Feb 2016 14:27:43 -0500

On Thu, Feb 25, 2016 at 4:51 AM, Christer Holmberg <
[email-masked]> wrote:

> “Following RFC 3279 [7] as updated by RFC
>
>               'MD5' [12], and 'MD2' [13], with 'SHA-1' preferred.”
>
>
>
> “Endpoints MUST support SHA-256 for generating and verifying the
> fingerprint
>
>                value associated with the DTLS association. The use of
> SHA-256 is preferred.”
>
>
>
> “Following RFC 3279 [7] as updated by RFC
>
>               'MD5' [12], and 'MD2' [13], with 'SHA-256' preferred.”
>
>
>
>
>
> Q3:        IF(Q1) Should the update be done within draft-dtls-sdp, or
> should we create a separate draft/milestone for it?
>
>
>
I think the has function preference should be updated in 4572. I would
prefer a separate draft for RFC 4572 update. There are enough issues with
RFC 4572, including handling of multiple fingerprints, that justify a
complete rewrite of TLS SDP negotiation procedures. If it would be decided
that RFC 4572 should be updated in draft-dtls-sdp (not my preference), I
would prefer to extend the draft to cover SDP for DTLS and TLS, so that it
obsoletes RFC 4572 instead of patching it.

Regards,
_____________
Roman Shpount

---

From: Christer Holmberg <[email-masked]>
Date: Thu, 25 Feb 2016 20:01:16 +0000

Hi,

If we think the update to 4572 will be more than “a few sentences”, I agree we should probably have a separate draft. We are already updating two RFCs in draft-dtls-sdp, so…

Regards,

Christer

From: Roman Shpount [mailto:[email-masked]]
Sent: 25 February 2016 21:28
To: Christer Holmberg <[email-masked]>
Cc: [email-masked]; Martin Thomson ([email-masked]) <[email-masked]>; [email-masked]
Subject: Re: Aligning RFC 4572 and draft-dtls-sdp regarding preferred SHA cipher?

On Thu, Feb 25, 2016 at 4:51 AM, Christer Holmberg <[email-masked]<mailto:[email-masked]>> wrote:
RFC 4572 (tls-sdp) contains the following text:

“Endpoints MUST support SHA-256 for generating and verifying the fingerprint
               value associated with the DTLS association. The use of SHA-256 is preferred.”

I think the has function preference should be updated in 4572. I would prefer a separate draft for RFC 4572 update. There are enough issues with RFC 4572, including handling of multiple fingerprints, that justify a complete rewrite of TLS SDP negotiation procedures. If it would be decided that RFC 4572 should be updated in draft-dtls-sdp (not my preference), I would prefer to extend the draft to cover SDP for DTLS and TLS, so that it obsoletes RFC 4572 instead of patching it.

Regards,
_____________
Roman Shpount